带有hibernate：hasRole（）的Spring Security性在配置中不起作用

Question

我正在尝试为我的Spring+Hibernate项目实现Spring Security性。

但是我在intercept-url标记中编写的hasRole('super_admin')不起作用。

请找到我在下面所做的配置。

<http auto-config="true" use-expressions="true">
        <intercept-url pattern="/admin**" access="hasRole('SUPER_ADMIN')" />
        <!-- access denied page -->
        <access-denied-handler error-page="/403" />
        <form-login login-page="/login" default-target-url="/welcome" authentication-failure-url="/login?error" username-parameter="username"
            login-processing-url="/loginCheck" password-parameter="password" />
        <logout logout-success-url="/login?logout" />
        <!-- enable csrf protection -->
        <csrf />
    </http>

    <authentication-manager>
        <authentication-provider user-service-ref="myUserDetailsServices">
            <password-encoder hash="bcrypt" />
        </authentication-provider>
    </authentication-manager>

public class MyUserDetailsServices implements UserDetailsService {

    private UserDao userDao;

    @Override
    @Transactional
    public UserDetails loadUserByUsername(final String username) throws UsernameNotFoundException {

        User user = userDao.findByEmail(username);
        if (user == null) {
            throw new UsernameNotFoundException("User " + username + " not found");
        }
        List<GrantedAuthority> authorities = buildUserAuthority(user.getRoles());
        return buildUserForAuthentication(user, authorities);

    }

    private org.springframework.security.core.userdetails.User buildUserForAuthentication(User user, List<GrantedAuthority> authorities) {
        return new org.springframework.security.core.userdetails.User(user.getEmail(), user.getPassword(), true, true, true, true, authorities);
    }

    private List<GrantedAuthority> buildUserAuthority(Set<Role> userRoles) {

        Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();

        for (Role userRole : userRoles) {
            setAuths.add(new SimpleGrantedAuthority(userRole.getRoleName()));
        }

        List<GrantedAuthority> Result = new ArrayList<GrantedAuthority>(setAuths);

        return Result;
    }

    public UserDao getUserDao() {
        return userDao;
    }

    public void setUserDao(UserDao userDao) {
        this.userDao = userDao;
    }

}

但hasRole('super_admin')仍然不工作。我无法访问http://127.0.0.1:8080/myproj/admin页面。用户正在进行身份验证并登录。但是上面的url被重定向到/403（访问被拒绝）。

我是不是漏掉了什么？请帮帮我！

Answer 1

HasRole运行良好。代码中不起作用的是SpringSecurity.xml上的通配符。更改此

至